ThreatFox: ACR Stealer IOCs

Hunt Hypothesis

This hunt targets adversary behavior where threat actors deploy the ACR Stealer malware to exfiltrate sensitive credentials and data from Azure environments using three specific indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of this high-severity stealer can prevent lateral movement and significant data loss before the adversary establishes persistence.

IOC Summary

Malware Family: ACR Stealer Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ACR Stealer
let malicious_domains = dynamic(["dl.connectivityplatform.cc", "auth.predatordeuce.cc", "predatordeuce.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ACR Stealer

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: ACR Stealer IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Enterprise Antivirus Signature Updates

  • Scenario: The organization uses a centralized endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) that performs scheduled definition updates. These updates often involve downloading and executing installer packages containing hashes or file paths that overlap with known ACR Stealer IOCs (specifically legitimate DLLs or executable names used by the AV vendor).
  • Suggested Filter: Exclude alerts where the Process Name matches the specific antivirus service executables (e.g., C:\Program Files\CrowdStrike\fsagent.exe, MsMpEng.exe) and the Parent Process is the scheduled update task (Task Scheduler or Service Control Manager).

• Software Deployment via SCCM/Intune

  • Scenario: The IT team utilizes Microsoft Endpoint Configuration Manager (MECM) or Intune to deploy a new version of a productivity suite (e.g., Adobe Acrobat Reader, Zoom, or Chrome). During the installation phase, the deployment agent extracts temporary files and executes setup scripts that generate network connections or file creations matching ACR Stealer IOCs.
  • Suggested Filter: Create an exclusion for User Account names ending in _svc, SYSTEM, or specific service accounts (e.g., DOMAIN\SCCM-Deploy-Svc) running on the deployment agent process (ccmexec.exe or IntuneManagementExtension.exe).

• Internal Patch Management Scans

  • Scenario: A scheduled vulnerability assessment tool (such as Qualys, Tenable Nessus, or Rapid7 InsightVM) runs an agent-based scan during off-hours. The scanner probes the system registry and file system